The Peer-to-Peer Routing Rule
WebRTC is the technology that powers real-time voice and video communication in the browser without requiring plugins. When a WebRTC connection is established between two peers (like two people in a browser-based video chat), the protocol attempts to find the shortest, fastest network path between them. To achieve this, it gathers various IP addresses—including the public IP address of your router and, controversially, internal network IPs.
The “Enable WebRTC remote-bound IPs” experimental flag controls a very specific routing behavior regarding these internal IPs. When enabled, it allows Chrome to use WebRTC to attempt connections to “remote-bound” IP addresses—essentially allowing the browser to try and route media traffic to internal, private IP addresses that exist on the *other* person’s network, or to specific VPN interfaces. While this can theoretically improve call connectivity in highly complex, multi-layered enterprise network topologies, it represents a significant security and privacy risk. It allows a malicious webpage utilizing WebRTC to potentially map or probe private IP subnets. If you value strict network privacy over edge-case video call connectivity, you should disable this routing allowance.
How to Restrict WebRTC Routing
You can force Chrome to restrict which IP addresses WebRTC is allowed to attempt connections with via the experimental flags menu.
- Open Google Chrome.
- Click inside the main address bar at the top of the browser.
- Type
chrome://flagsand press Enter. - On the “Experiments” page, use the search bar to look for Enable WebRTC remote-bound IPs.
- If the flag is present, click the dropdown menu next to it and change it from “Default” to Disabled.
- Click the blue Relaunch button at the bottom of the screen.
Upon restarting, Chrome will restrict WebRTC from blindly attempting to connect to remote internal IP subnets, increasing your defense against network probing attacks.